diff options
author | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-08-16 14:31:57 +0800 |
---|---|---|
committer | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-08-20 14:41:01 +0800 |
commit | 004b8112380bb239a2b83524d890a697765f0d81 (patch) | |
tree | 3c4ba5e17d269ae63845b8f892c18261dfa57d1f /ShellPkg/Library | |
parent | 90b3f171a76cde0d824d17895d6ff7f434afe29c (diff) | |
download | edk2-004b8112380bb239a2b83524d890a697765f0d81.tar.gz edk2-004b8112380bb239a2b83524d890a697765f0d81.tar.bz2 edk2-004b8112380bb239a2b83524d890a697765f0d81.zip |
ShellPkg/edit: Fix heap access out-of-bounds
The issue was found when heap guard is turned on.
PrintLib somehow receives a non-null terminated string in var-arg.
When the PrintLib implementation reads the string it keeps
reading because no null-terminator is met, which triggers the page
fault set by the heap guard.
The issue is caused by a bug in FileBufferPrintLine().
When "edit" opens a binary file, in FileBufferPrintLine(),
the Line->Buffer may start with \x00 \x00, but the Line->Size is
larger than MainEditor.ScreenSize.Column, it causes the PrintLine is
set to an empty string by below call:
StrnCpyS (
PrintLine, BufLen/sizeof(CHAR16), Buffer,
MIN(Limit, MainEditor.ScreenSize.Column)
);
But since Limit (equals to Line->Size) is larger than
MainEditor.ScreenSize.Column, below for-loop doesn't successfully
set the whole PrintLine to all-empty-space.
for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
PrintLine[Limit] = L' ';
}
So after the for-loop, PrintLine is still an empty string.
Later in below call, the PrintLine2 is created based on PrintLine.
ShellCopySearchAndReplace (
PrintLine, PrintLine2,
BufLen * 2, L"%", L"^%", FALSE, FALSE
);
But due to the implementation of ShellCopySearchAndReplace(),
PrintLine2 is untouched and INVALID_PARAMETER is returned.
Finally an uninitialized string is passed to ShellPrintEx()
which causes the #PF exception.
The fix is to reset Limit to StrLen(PrintLine) before for-loop.
So that PrintLine can be converted from an empty string to a
string containing all spaces.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Jian Wang <jian.j.wang@intel.com>
Diffstat (limited to 'ShellPkg/Library')
-rw-r--r-- | ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c index 56ccd399b0..39a5afb53f 100644 --- a/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c +++ b/ShellPkg/Library/UefiShellDebug1CommandsLib/Edit/FileBuffer.c @@ -500,7 +500,7 @@ FileBufferPrintLine ( PrintLine = AllocatePool (BufLen);
if (PrintLine != NULL) {
StrnCpyS (PrintLine, BufLen/sizeof(CHAR16), Buffer, MIN(Limit, MainEditor.ScreenSize.Column));
- for (; Limit < MainEditor.ScreenSize.Column; Limit++) {
+ for (Limit = StrLen (PrintLine); Limit < MainEditor.ScreenSize.Column; Limit++) {
PrintLine[Limit] = L' ';
}
|